Call traffic data monitoring and management

ABSTRACT

One example method of operation may include identifying one or more call parameters associated with each of a number of calls received over a fixed period of time, assigning scores to each of the calls based on the one or more identified call parameters for each of the plurality of calls, assigning one or more of the calls to a scam call category based on the assigned scores, and responsive to the assigning of the one or more of the calls to a scam call category, determining whether a number of remaining calls of the calls, which are not assigned to the scam call category, have increased or decreased beyond a deviation margin of a target percentage of calls.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.16/732,284, filed on Dec. 31, 2019, now U.S. Pat. No. 11,050,879, issuedon Jun. 29, 2021, the entire disclosure of which are incorporated byreference herein.

TECHNICAL FIELD OF THE APPLICATION

This application relates to call monitoring on a call managementnetwork, and more specifically to call traffic data monitoring andmanagement.

BACKGROUND OF THE APPLICATION

Conventionally, mobile device users receive calls from undesired sourcesevery day and sometimes several times an hour depending on theparticular day. The source numbers which are used to dial the users maybe local numbers, long-distance numbers, anonymous numbers, spoofednumbers, etc. The calls may be spam calls, scam calls, robocalls, etc.

Validation of calls to identify which calls are legitimate is part ofthe scam call management process. For example, call originationvalidation is one approach to identifying whether a call should berouted, answered, blocked, etc. Current approaches to validating callsmay require a number of burdensome operations and may not be performedfast enough to maintain a real-time scam call management solution.

SUMMARY OF THE APPLICATION

Example embodiments of the present application provide a methodincluding one or more of identifying one or more call parametersassociated with each of a plurality of calls received over a fixedperiod of time, assigning scores to each of the plurality of calls basedon the one or more identified call parameters for each of the pluralityof calls, assigning one or more of the plurality of calls to a scam callcategory based on the assigned scores, and responsive to the assigningof the one or more of the plurality of calls to a scam call category,determining whether a number of remaining calls of the plurality ofcalls, which are not assigned to the scam call category, have increasedor decreased beyond a deviation margin of a target percentage of calls.

Another example embodiment may include an apparatus that includes aprocessor configured to identify one or more call parameters associatedwith each of a plurality of calls received over a fixed period of time,assign scores to each of the plurality of calls based on the one or moreidentified call parameters for each of the plurality of calls, assignone or more of the plurality of calls to a scam call category based onthe assigned scores, and responsive to the one or more of the pluralityof calls to being assigned a scam call category, determine whether anumber of remaining calls of the plurality of calls, which are notassigned to the scam call category, have increased or decreased beyond adeviation margin of a target percentage of calls.

Still another example embodiment may include a non-transitory computerreadable storage medium configured to store instructions that whenexecuted cause a processor to perform identifying one or more callparameters associated with each of a plurality of calls received over afixed period of time, assigning scores to each of the plurality of callsbased on the one or more identified call parameters for each of theplurality of calls, assigning one or more of the plurality of calls to ascam call category based on the assigned scores, and responsive to theassigning of the one or more of the plurality of calls to a scam callcategory, determining whether a number of remaining calls of theplurality of calls, which are not assigned to the scam call category,have increased or decreased beyond a deviation margin of a targetpercentage of calls.

Still another example embodiment may include a method that includes atleast one of determining a call received from a calling party andintended for a subscriber device has an elevated likelihood of being ascam call, determining a percentage of calls over a current period oftime being filtered as scam calls by a carrier server, when thepercentage of calls being filtered as scam calls during the currentperiod of time is above a call threshold percentage, retrieving callhistory information associated with a subscriber profile of thesubscriber device, identifying one or more call patterns from the callhistory information of the subscriber profile corresponding to thereceived call, and determining whether to permit the received call basedon the identified one or more call patterns.

Still yet another example embodiment may include an apparatus thatincludes a processor configured to determine a call received from acalling party and intended for a subscriber device has an elevatedlikelihood of being a scam call, determine a percentage of calls over acurrent period of time being filtered as scam calls by a carrier server,when the percentage of calls being filtered as scam calls during thecurrent period of time is above a call threshold percentage, retrievecall history information associated with a subscriber profile of thesubscriber device, identify one or more call patterns from the callhistory information of the subscriber profile corresponding to thereceived call, and determine whether to permit the received call basedon the identified one or more call patterns.

Still yet another example embodiment may include a non-transitorycomputer readable storage medium configured to store instructions thatwhen executed cause a processor to perform one or more of determining acall received from a calling party and intended for a subscriber devicehas an elevated likelihood of being a scam call, determining apercentage of calls over a current period of time being filtered as scamcalls by a carrier server, when the percentage of calls being filteredas scam calls during the current period of time is above a callthreshold percentage, retrieving call history information associatedwith a subscriber profile of the subscriber device, identifying one ormore call patterns from the call history information of the subscriberprofile corresponding to the received call, and determining whether topermit the received call based on the identified one or more callpatterns.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates an example network configuration of a call processingnetwork for receiving and filtering incoming calls for a particularcarrier network according to example embodiments.

FIG. 2 illustrates another example network configuration of a callprocessing network for receiving and filtering an incoming call for aparticular carrier network based on subscriber profile informationaccording to example embodiments.

FIG. 3A illustrates a call management procedure for scoring andfiltering incoming calls according to example embodiments.

FIG. 3B illustrates a call management procedure for filtering anincoming call based on a particular user profile according to exampleembodiments.

FIG. 4 illustrates a system configuration of a call being received andprocessed by a call network management configuration according toexample embodiments.

FIG. 5A illustrates a logic flow diagram of call management procedureaccording to example embodiments.

FIG. 5B illustrates a logic flow diagram of a call filtering procedurebased on a particular subscriber profile according to exampleembodiments.

FIG. 6 illustrates an example network entity device configured to storeinstructions, software, and corresponding hardware for executing thesame, according to example embodiments of the present application.

DETAILED DESCRIPTION OF THE APPLICATION

It will be readily understood that the components of the presentapplication, as generally described and illustrated in the figuresherein, may be arranged and designed in a wide variety of differentconfigurations. Thus, the following detailed description of theembodiments of a method, apparatus, and system, as represented in theattached figures, is not intended to limit the scope of the applicationas claimed, but is merely representative of selected embodiments of theapplication.

The features, structures, or characteristics of the applicationdescribed throughout this specification may be combined in any suitablemanner in one or more embodiments. For example, the usage of the phrases“example embodiments”, “some embodiments”, or other similar language,throughout this specification refers to the fact that a particularfeature, structure, or characteristic described in connection with theembodiment may be included in at least one embodiment of the presentapplication. Thus, appearances of the phrases “example embodiments”, “insome embodiments”, “in other embodiments”, or other similar language,throughout this specification do not necessarily all refer to the samegroup of embodiments, and the described features, structures, orcharacteristics may be combined in any suitable manner in one or moreembodiments.

In addition, while the term “message” has been used in the descriptionof embodiments of the present application, the application may beapplied to many types of network data, such as, packet, frame, datagram,etc. For purposes of this application, the term “message” also includespacket, frame, datagram, and any equivalents thereof. Furthermore, whilecertain types of messages and signaling are depicted in exemplaryembodiments of the application, the application is not limited to acertain type of message, and the application is not limited to a certaintype of signaling.

Example embodiments provide call filtering baseline setup procedures andcall filtering operations for incoming calls. A baseline may be setupbased on incoming calls by applying call filtering criteria associatedwith call parameter auditing procedures. Once a baseline is established,subsequent calls received may be filtered by applying the baselinefiltering data, which may have been adjusted based on the most recentbaseline call parameter data. Incoming calls may also be filteredaccording to specific subscriber information, which is applied when thebaseline call percentage is not satisfactory at a particular time (e.g.,baseline call data deviates from a target by an excessive marginamount).

FIG. 1 illustrates an example network configuration of a call processingnetwork for receiving and filtering incoming calls for a particularcarrier network according to example embodiments. Referring to FIG. 1,the configuration 100 includes a calling party network(s) 110, which maybe a calling entity that initiates a call to a subscriber in a carriernetwork 120 being managed by a scam call management process. A thirdparty call server 114 may forward call data messages, such as sessioninitiation protocol (SIP) INVITE messages for a digital call placementprotocol. The calls 112 may be received from various third partynetworks at a carrier network server 128, which is part of a calledparty/carrier network 120. When the calls are received, each call may bescreened by identifying certain call parameters in a call messageassociated with the call. The call filtering criteria 122 may provideweights to assign to the call parameters from a list of call parametersweights from a current baseline approach to weighting the callparameters. The weights are applied, the calls are scored based on thesum of weights and/or other factors, and the calls which are scored at alevel that is below a scam call threshold level are permitted 124instead of being blocked. The carrier subscribers 132 are then forwardedcorresponding calls which were intended for their devices and which arenot labeled as scam calls.

FIG. 2 illustrates another example network configuration of a callprocessing network for receiving and filtering an incoming call for aparticular carrier network based on subscriber profile informationaccording to example embodiments. Referring to FIG. 2, the configuration200 provides an example where a specific call is examined for aparticular subscriber. The call 212 may be received and processed priorto being forwarded 224 to a carrier subscriber 232. The call may berecognized as having a potential for scam based on a score assigned tothe call, which is based on call parameters associated with the callmessage data. When the call is identified as scam or a number/percentageof recent calls are labeled as scam, another subscriber-specificcriteria may be invoked to determine how to process the call. Forexample, the subscriber profile information 222 may be retrieved toidentify whether the subscriber has call history information whichidentifies the current caller of the placed call 212. The caller historyinformation may identify previous calling history between the caller andthe subscriber 232, which can assist with a decision as to whether thecurrent call should be forwarded to the carrier or blocked.

FIG. 3A illustrates a call management procedure for scoring andfiltering incoming calls according to example embodiments. Referring toFIG. 3A, in this example 300, a baseline of calls received at aparticular carrier over a period of time (e.g., 5, 10 minutes, etc.) arescored based on scoring guidelines, such as parameter weights which areapplied to the identified call parameters. In one example, responsive tovarious calls being received at a particular carrier server, one or morecall parameters are identified 312, which are associated with each ofthose plurality of calls received over a fixed period of time. Theparameters are each assigned scores 314 for each of the plurality ofcalls. This way, each incoming call will be assigned a score separatelybased on its independent call parameters. For example, when an IPaddress is identified a threshold number of times in a particular timeperiod, the IP address will be a suspect call parameter for subsequentcalls that will invoke a weighted value (i.e., +2) each time that IPaddress appears in a call parameter of an incoming call. Other IPaddresses may not invoke a weighted value being added to the incomingcall assuming those IP addresses are not identified at a particularfrequency of instances and time. This is just one example of a suspectcall parameter causing a scam likelihood score to increase for aparticular call, however, other call parameters, if identified, maycause a scam likelihood score to increase.

Once the calls are scored, the scores may be identified and compared toa threshold call score to identify whether the call will be designatedas a scam likely call 316. If the score is not equal to or above thescam likely score, then the call may be considered a regular permissiblecall. The calls that are above the threshold may be designated to a scamcategory 318. The scam call categories may include very likely (i.e.,above a highest threshold), likely (i.e., above a high threshold butbelow the highest threshold), and somewhat likely (i.e., above a suspectthreshold but below the high threshold).

In another applied criteria for identifying scam calls, the number orpercentage of remaining calls, which are not identified as scam, whichexceed, as a total number of calls, a particular deviation margin ineither a surplus or a deficiency, may cause a weight distribution madeto certain call parameters. For example, if a target percentage of callsis 90 percent or ‘X’ number of calls over a period of time, and thecalls which are being forwarded and not identified as scam and notblocked has deviated outside a hysteresis margin near the target (i.e.,10 percent) 322, then the call parameters may be changed 326. Forexample, if too many calls are identified as scam, then one or moreflagged IP addresses which are weighted with a +4 value when identifiedmay be modified to represent a +3 or a +2 value when scoring subsequentcalls with the new adjusted weight values for the call parameters 326.If however, the target is being met substantially and is within themargin of deviation, then the current weight assignments to those callparameters may be maintained 324. Then, the modified call parameters canbe applied to new incoming calls 328 for a new call scoring procedurethat may score calls differently in an attempt to reach the target callnumbers.

When assigning scores to each of the plurality of calls based on the oneor more identified call parameters for each of the plurality of calls,the process may include summing weights assigned to each of the one ormore identified call parameters for each of the plurality of calls.Also, when the number of remaining calls has decreased beyond adeviation margin of the target number of calls, then the weightsassigned to one or more of the call parameters can be decreased tocreate the new one or more modified call parameters. Additionally, whenidentifying the modified call parameters associated with each of aplurality of new calls received over another fixed period of time thatis later than the original fixed period of time, then scores may beassigned to each of the plurality of new calls based on the decreasedone or more assigned weights assigned to the modified call parameters.When the number of remaining calls has increased beyond a deviationmargin of the target number of calls, the one or more weights assignedto one or more of the call parameters may be increased. As for thedeviation margin, the deviation margin may be a hysteresis value of atleast five percent and is equal to one or more of five percent, tenpercent, fifteen percent and twenty percent or higher or any numberin-between. Also, the one or more call parameters can include one ormore of Internet protocol (IP) addresses, area codes, telephone numbers,and caller identification name (CNAM) data, and the one or more callparameters are included in call messages associated with each of theplurality of calls. When any of those parameters are assigned a weightedvalue those values are provided in a list which updates depending on thelatest value assignments.

FIG. 3B illustrates a call management procedure for filtering anincoming call based on a particular user profile according to exampleembodiments. Referring to FIG. 3B, in this example 350, a same call scamlimiting criteria is used as in the other examples, however, for callson an individual basis, parameter auditing, scoring, etc., may beapplied for calls to be labeled as scam or not scam. In this example,however, other exceptions on a per-call basis are applied, such aspersonal contacts, previous calls, callback history. Also, the currentcall percentage threshold may be lowered or disregarded in certaincircumstances.

In this example procedure, the process 350 provides determining a callreceived from a calling party and intended for a subscriber device hasan elevated likelihood of being a scam call 352, determining apercentage of calls over a current period of time being filtered as scamcalls by a carrier server 354, when the percentage of calls beingfiltered as scam calls during the current period of time is above a callthreshold percentage 356, call history information is retrievedassociated with a subscriber profile of the subscriber device 358, andone or more call patterns from the call history information of thesubscriber profile corresponding to the received call may be identifiedand used to permit the received call based on the identified one or morecall patterns 362. The call patterns may include call history, such asincoming calls from the caller party, outgoing calls to the caller partyfrom the called party, frequency of calls to and from the parties,length of calls to and from the called parties, etc. If no exceptionsare identified the call can be filtered out and blocked as scam 364. Theweight of the call can be modified 366 once the exception is identified.The exception(s) can be applied as a negative weight (i.e., −2) tooffset a call parameter flagged weight. A call parameter list may beupdated to include the new call parameters 368 so they can be applied tosubsequent incoming calls.

When determining the received call intended for the subscriber devicehas an elevated likelihood of being a scam call the process may includedetermining one or more call parameters, from a call message associatedwith the call, is assigned a weight value that elevates the likelihoodof the call being a scam call. The one or more call parameters are notlimited to, but can include one or more of: Internet protocol (IP)addresses, telephone area codes, telephone numbers, and calleridentification name (CNAM) data. The call patterns associated with thesubscriber profile can include one or more of, but are not limited to, anumber of times the calling party called the subscriber device, a numberof the times the subscriber device called the calling party, a frequencyof calls over a period of time that the calling party called thesubscriber device or the subscriber device called the calling party, anda length of time of one or more previous call sessions between thecalling party and the subscriber device. The process may includemodifying a weight value assigned to the one or more call parametersbased on the identified one or more call patterns, and storing themodified one or more call parameters in a call parameter list.

The process may also include identifying a call exception from the oneor more call patterns, and determining a calling party number associatedwith the call exception matches a calling party number of the receivedcall. Responsive to determining the calling party number associated withthe call exception matches the calling party number of the receivedcall, the process may include forwarding the call to the subscriberdevice.

FIG. 4 illustrates a system configuration of a call being received andprocessed by a call network management configuration according toexample embodiments. Referring to FIG. 4, the system 400 includes acaller entity 410, such as a calling device on a third party network.The call is originated 432 via the originating network 412 and the callinvokes a call message to be created with relevant call message data 434based on a digital call communication protocol. A call authenticationengine 414 may provide a gateway to validate the calling and calledparties to identify whether the call is a valid call to valid registeredparties. Once the call is received on the receiving end, the terminatingnetwork 416 may identify the call header message data 436 to determinewhich recipient is registered to receive the call. The call data may beforwarded 438 to a rules engine 418 which can then determine alikelihood of the call being a scam 441, determine the currentpercentage of filtered calls 442, retrieve call history of thesubscriber/recipient 444, identify any relevant call patterns 446 fromthe call history, and permit the call 448 based on the callscoring/pattern information, etc. Then, connect the call 452 to thesubscriber 420 assuming the call is not determined to be a scam call.

FIG. 5A illustrates a logic flow diagram of call management procedureaccording to example embodiments. Referring to FIG. 5A, the process 500may include identifying one or more call parameters associated with eachof a plurality of calls received over a fixed period of time 512,assigning scores to each of the plurality of calls based on the one ormore identified call parameters for each of the plurality of calls 514,assigning one or more of the plurality of calls to a scam call categorybased on the assigned scores 516, responsive to the assigning of the oneor more of the plurality of calls to a scam call category, determiningwhether a number of remaining calls of the plurality of calls, which arenot assigned to the scam call category, have increased or decreasedbeyond a deviation margin of a target percentage of calls 518.

FIG. 5B illustrates a logic flow diagram of a call filtering procedurebased on a particular subscriber profile according to exampleembodiments. Referring to FIG. 5B, the process 550 may includedetermining a call received from a calling party and intended for asubscriber device has an elevated likelihood of being a scam call 552,determining a percentage of calls over a current period of time beingfiltered as scam calls by a carrier server 554, when the percentage ofcalls being filtered as scam calls during the current period of time isabove a call threshold percentage, retrieving call history informationassociated with a subscriber profile of the subscriber device 556,identifying one or more call patterns from the call history informationof the subscriber profile corresponding to the received call 558,determining whether to permit the received call based on the identifiedone or more call patterns 562.

The operations of a method or algorithm described in connection with theembodiments disclosed herein may be embodied directly in hardware, in acomputer program executed by a processor, or in a combination of thetwo. A computer program may be embodied on a computer readable medium,such as a storage medium. For example, a computer program may reside inrandom access memory (“RAM”), flash memory, read-only memory (“ROM”),erasable programmable read-only memory (“EPROM”), electrically erasableprogrammable read-only memory (“EEPROM”), registers, hard disk, aremovable disk, a compact disk read-only memory (“CD-ROM”), or any otherform of storage medium known in the art.

FIG. 6 illustrates an example network entity device configured to storeinstructions, software, and corresponding hardware for executing thesame, according to example embodiments of the present application. FIG.6 is not intended to suggest any limitation as to the scope of use orfunctionality of embodiments of the application described herein.Regardless, the computing node 600 is capable of being implementedand/or performing any of the functionality set forth hereinabove.

In computing node 600 there is a computer system/server 602, which isoperational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 602 include, but are notlimited to, personal computer systems, server computer systems, thinclients, rich clients, hand-held or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 602 may be described in the general context ofcomputer system-executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 602 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 6, computer system/server 602 in cloud computing node600 is shown in the form of a general-purpose computing device. Thecomponents of computer system/server 602 may include, but are notlimited to, one or more processors or processing units 604, a systemmemory 606, and a bus that couples various system components includingsystem memory 606 to processor 604.

The bus represents one or more of any of several types of busstructures, including a memory bus or memory controller, a peripheralbus, an accelerated graphics port, and a processor or local bus usingany of a variety of bus architectures. By way of example, and notlimitation, such architectures include Industry Standard Architecture(ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA)bus, Video Electronics Standards Association (VESA) local bus, andPeripheral Component Interconnects (PCI) bus.

Computer system/server 602 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 602, and it includes both volatileand non-volatile media, removable and non-removable media. System memory606, in one embodiment, implements the flow diagrams of the otherfigures. The system memory 606 can include computer system readablemedia in the form of volatile memory, such as random-access memory (RAM)610 and/or cache memory 612. Computer system/server 602 may furtherinclude other removable/non-removable, volatile/non-volatile computersystem storage media. By way of example only, storage system 614 can beprovided for reading from and writing to a non-removable, non-volatilemagnetic media (not shown and typically called a “hard drive”). Althoughnot shown, a magnetic disk drive for reading from and writing to aremovable, non-volatile magnetic disk (e.g., a “floppy disk”), and anoptical disk drive for reading from or writing to a removable,non-volatile optical disk such as a CD-ROM, DVD-ROM or other opticalmedia can be provided. In such instances, each can be connected to thebus by one or more data media interfaces. As will be further depictedand described below, memory 606 may include at least one program producthaving a set (e.g., at least one) of program modules that are configuredto carry out the functions of various embodiments of the application.

Program/utility 616, having a set (at least one) of program modules 618,may be stored in memory 606 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment. Program modules 618 generally carry out the functionsand/or methodologies of various embodiments of the application asdescribed herein.

As will be appreciated by one skilled in the art, aspects of the presentapplication may be embodied as a system, method, or computer programproduct. Accordingly, aspects of the present application may take theform of an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present application may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Computer system/server 602 may also communicate with one or moreexternal devices 620 such as a keyboard, a pointing device, a display622, etc.; one or more devices that enable a user to interact withcomputer system/server 602; and/or any devices (e.g., network card,modem, etc.) that enable computer system/server 602 to communicate withone or more other computing devices. Such communication can occur viaI/O interfaces 624. Still yet, computer system/server 602 cancommunicate with one or more networks such as a local area network(LAN), a general wide area network (WAN), and/or a public network (e.g.,the Internet) via network adapter 626. As depicted, network adapter 626communicates with the other components of computer system/server 602 viaa bus. It should be understood that although not shown, other hardwareand/or software components could be used in conjunction with computersystem/server 602. Examples include, but are not limited to: microcode,device drivers, redundant processing units, external disk drive arrays,RAID systems, tape drives, and data archival storage systems, etc.

Although an exemplary embodiment of at least one of a system, method,and non-transitory computer readable medium has been illustrated in theaccompanied drawings and described in the foregoing detaileddescription, it will be understood that the application is not limitedto the embodiments disclosed, but is capable of numerous rearrangements,modifications, and substitutions as set forth and defined by thefollowing claims. For example, the capabilities of the system of thevarious figures can be performed by one or more of the modules orcomponents described herein or in a distributed architecture and mayinclude a transmitter, receiver or pair of both. For example, all orpart of the functionality performed by the individual modules, may beperformed by one or more of these modules. Further, the functionalitydescribed herein may be performed at various times and in relation tovarious events, internal or external to the modules or components. Also,the information sent between various modules can be sent between themodules via at least one of: a data network, the Internet, a voicenetwork, an Internet Protocol network, a wireless device, a wired deviceand/or via plurality of protocols. Also, the messages sent or receivedby any of the modules may be sent or received directly and/or via one ormore of the other modules.

One skilled in the art will appreciate that a “system” could be embodiedas a personal computer, a server, a console, a personal digitalassistant (PDA), a cell phone, a tablet computing device, a smartphoneor any other suitable computing device, or combination of devices.Presenting the above-described functions as being performed by a“system” is not intended to limit the scope of the present applicationin any way but is intended to provide one example of many embodiments.Indeed, methods, systems and apparatuses disclosed herein may beimplemented in localized and distributed forms consistent with computingtechnology.

It should be noted that some of the system features described in thisspecification have been presented as modules, in order to moreparticularly emphasize their implementation independence. For example, amodule may be implemented as a hardware circuit comprising custom verylarge-scale integration (VLSI) circuits or gate arrays, off-the-shelfsemiconductors such as logic chips, transistors, or other discretecomponents. A module may also be implemented in programmable hardwaredevices such as field programmable gate arrays, programmable arraylogic, programmable logic devices, graphics processing units, or thelike.

A module may also be at least partially implemented in software forexecution by various types of processors. An identified unit ofexecutable code may, for instance, comprise one or more physical orlogical blocks of computer instructions that may, for instance, beorganized as an object, procedure, or function. Nevertheless, theexecutables of an identified module need not be physically locatedtogether but may comprise disparate instructions stored in differentlocations which, when joined logically together, comprise the module andachieve the stated purpose for the module. Further, modules may bestored on a computer-readable medium, which may be, for instance, a harddisk drive, flash device, random access memory (RAM), tape, or any othersuch medium used to store data.

Indeed, a module of executable code could be a single instruction, ormany instructions, and may even be distributed over several differentcode segments, among different programs, and across several memorydevices. Similarly, operational data may be identified and illustratedherein within modules and may be embodied in any suitable form andorganized within any suitable type of data structure. The operationaldata may be collected as a single data set or may be distributed overdifferent locations including over different storage devices, and mayexist, at least partially, merely as electronic signals on a system ornetwork.

It will be readily understood that the components of the application, asgenerally described and illustrated in the figures herein, may bearranged and designed in a wide variety of different configurations.Thus, the detailed description of the embodiments is not intended tolimit the scope of the application as claimed but is merelyrepresentative of selected embodiments of the application.

One having ordinary skill in the art will readily understand that theabove may be practiced with steps in a different order, and/or withhardware elements in configurations that are different than those whichare disclosed. Therefore, although the application has been describedbased upon these preferred embodiments, it would be apparent to those ofskill in the art that certain modifications, variations, and alternativeconstructions would be apparent.

While preferred embodiments of the present application have beendescribed, it is to be understood that the embodiments described areillustrative only and the scope of the application is to be definedsolely by the appended claims when considered with a full range ofequivalents and modifications (e.g., protocols, hardware devices,software platforms etc.) thereto.

What is claimed is:
 1. A method comprising: assigning one or more of aplurality of calls to a scam call category based on assigned scoresrelated to one or more identified call parameters; and performing one ormore of decreasing or increasing one or more weights assigned to one ormore of the call parameters to create one or more modified callparameters depending on whether a number of remaining calls of theplurality of calls, which are not assigned to the scam call category,have increased or decreased beyond a deviation margin of a targetpercentage of the plurality of calls received over a period of time. 2.The method of claim 1, wherein the assigned scores comprise summingweights assigned to each of the one or more identified call parametersfor each of the plurality of calls.
 3. The method of claim 1,comprising: when the number of remaining calls has decreased beyond thedeviation margin of the target number of calls, decreasing the one ormore weights.
 4. The method of claim 3, comprising: identifying the oneor more modified call parameters associated with each of a plurality ofnew calls received over another period of time later than the period oftime; and assigning a score to each of the plurality of new calls basedon the decreased one or more weights.
 5. The method of claim 1,comprising: when the number of remaining calls has increased beyond thedeviation margin of the target number of calls, increasing the one ormore weights.
 6. The method of claim 1, wherein the deviation margin isat least five percent and is equal to one or more of five percent, tenpercent, fifteen percent and twenty percent.
 7. The method of claim 1,wherein the one or more call parameters comprise one or more of:Internet protocol (IP) addresses, area codes, telephone numbers, andcaller identification name (CNAM) data, and wherein the one or more callparameters are included in call messages associated with each of theplurality of calls.
 8. An apparatus comprising: a processor configuredto assign one or more of a plurality of calls to a scam call categorybased on assigned scores related to one or more identified callparameters; and perform one or more of decrease or increase one or moreweights assigned to one or more of the call parameters to create one ormore modified call parameters that depend on whether a number of callsthat remain of the plurality of calls, which are not assigned to thescam call category, have increased or decreased beyond a deviationmargin of a target percentage of the plurality of calls received over aperiod of time
 9. The apparatus of claim 8, wherein the processor isconfigured to sum weights, related to the assigned scores, assigned toeach of the one or more call parameters for each of the plurality ofcalls.
 10. The apparatus of claim 8, wherein the processor is furtherconfigured to, when the number of calls that remain has decreased beyondthe deviation margin of the target number of calls, decrease the one ormore weights.
 11. The apparatus of claim 10, wherein the processor isalso configured to identify the one or more modified call parametersassociated with each of a plurality of new calls received over anotherperiod of time later than the period of time, and assign a score to eachof the plurality of new calls based on the decreased one or moreweights.
 12. The apparatus of claim 8, wherein the processor is furtherconfigured to, when the number of calls that remain has increased beyondthe deviation margin of the target number of calls, increase the one ormore weights.
 13. The apparatus of claim 8, wherein the deviation marginis at least five percent and is equal to one or more of five percent,ten percent, fifteen percent and twenty percent.
 14. The apparatus ofclaim 8, wherein the one or more call parameters comprise one or moreof: Internet protocol (IP) addresses, area codes, telephone numbers, andcaller identification name (CNAM) data, and wherein the one or more callparameters are included in call messages associated with each of theplurality of calls.
 15. A non-transitory computer readable storagemedium configured to store instructions that when executed cause aprocessor to perform: assigning one or more of a plurality of calls to ascam call category based on assigned scores related to one or moreidentified call parameters; and performing one or more of decreasing orincreasing one or more weights assigned to one or more of the callparameters to create one or more modified call parameters depending onwhether a number of remaining calls of the plurality of calls, which arenot assigned to the scam call category, have increased or decreasedbeyond a deviation margin of a target percentage of the plurality ofcalls received over a period of time.
 16. The non-transitory computerreadable storage medium of claim 15, wherein the assigned scorescomprise summing weights assigned to each of the one or more identifiedcall parameters for each of the plurality of calls.
 17. Thenon-transitory computer readable storage medium of claim 15, wherein theprocessor is further configured to perform: when the number of remainingcalls has decreased beyond the deviation margin of the target number ofcalls, decreasing the one or more weights.
 18. The non-transitorycomputer readable storage medium of claim 17, wherein the processor isfurther configured to perform: identifying the one or more modified callparameters associated with each of a plurality of new calls receivedover another period of time later than the period of time; and assigninga score to each of the plurality of new calls based on the decreased oneor more weights.
 19. The non-transitory computer readable storage mediumof claim 15, wherein the processor is further configured to perform:when the number of remaining calls has increased beyond the deviationmargin of the target number of calls, increasing the one or moreweights.
 20. The non-transitory computer readable storage medium ofclaim 15, wherein the deviation margin is at least five percent and isequal to one or more of five percent, ten percent, fifteen percent andtwenty percent.